CVE-2026-80603 in Linux
Summary
by MITRE • 08/28/2026
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_conntrack_irc: fix parse_dcc() off-by-one OOB read
parse_dcc() treats data_end as an inclusive end pointer, but its only caller passes data_limit = ib_ptr + datalen, which points one past the last valid byte.
The newline search loop iterates while tmp <= data_end, so when no newline is present, *tmp is read at tmp == data_end, one byte beyond the region filled by skb_header_pointer().
irc_buffer is kmalloc'd as MAX_SEARCH_SIZE + 1 bytes and datalen is capped at MAX_SEARCH_SIZE, so the stray read does not fault. The byte is uninitialized or stale; if it contains an ASCII digit, simple_strtoul will consume it and produce a wrong DCC IP or port in the conntrack expectation. The extra allocation byte is also a fragile guard: if the cap or allocation size changes, this becomes a real out-of-bounds read.
Change the loop and its post-loop check to use strict less-than, consistent with the caller's exclusive-end convention. Update the function comment accordingly.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/28/2026
The Linux kernel vulnerability identified in netfilter involves an off-by-one out-of-bounds read within the nf_conntrack_irc module, specifically affecting the parse_dcc() function. This flaw stems from a mismatch between pointer conventions used by the caller and those expected by the parsing logic. The data_end parameter passed to parse_dcc is intended to serve as an inclusive end pointer, indicating the last valid byte in the buffer. However, its sole caller computes this value using the formula ib_ptr plus datalen, which results in a pointer that points one past the final valid byte of the allocated region. This discrepancy creates a scenario where the parsing loop iterates beyond the intended boundary under specific conditions.
The operational impact of this vulnerability is realized during the newline search process within parse_dcc(). The function employs a loop condition that checks if tmp is less than or equal to data_end. When no newline character is found in the input stream, the loop continues until tmp equals data_end. At this precise moment, the code attempts to dereference *tmp, resulting in an access one byte beyond the region populated by skb_header_pointer(). While the current implementation mitigates immediate system crashes because irc_buffer is allocated with MAX_SEARCH_SIZE plus one extra bytes and datalen is capped at MAX_SEARCH_SIZE, preventing a segmentation fault, this safety net relies on fragile assumptions. The stray read accesses uninitialized or stale memory content rather than valid network data.
The security implications of reading uninitialized memory are significant for connection tracking integrity. If the out-of-bounds byte happens to contain an ASCII digit character, subsequent processing by simple_strtoul will consume it as part of a numeric value. This leads to the calculation of incorrect IP addresses or port numbers within the conntrack expectation structure. Such data corruption can disrupt legitimate network connections or potentially be exploited in conjunction with other vulnerabilities to manipulate state tracking mechanisms. The reliance on an extra allocation byte acts only as a weak guard; any future modification that alters the cap size or allocation strategy could transform this theoretical flaw into a critical out-of-bounds read vulnerability capable of causing kernel panics or further memory corruption.
To remediate this issue, the loop condition and its post-loop validation logic were updated to use strict less-than comparisons instead of less-than-or-equal-to. This change aligns the internal parsing logic with the exclusive-end pointer convention established by the caller, ensuring that tmp never reaches a value equal to data_end during iteration. By enforcing this boundary constraint, the function prevents access beyond the valid buffer region regardless of whether newlines are present in the input stream. Additionally, the associated function comments were updated to accurately reflect these operational changes and clarify the pointer semantics for future maintainers.
From a classification perspective, this vulnerability corresponds to CWE-125, which describes an out-of-bounds read where data is accessed beyond the end of a buffer or array. The potential consequence of processing malformed input leading to incorrect state updates aligns with aspects of ATT&CK technique T1078, involving valid accounts and system configuration manipulation through trust exploitation, although primarily it represents a memory safety issue rather than an authentication bypass. Mitigation strategies include applying the kernel patch that corrects the loop bounds immediately upon release availability for affected distributions. Administrators should also ensure that network filtering rules are configured to inspect IRC traffic thoroughly, as this module is specifically designed to handle protocol-specific connection tracking for Internet Relay Chat and its associated Direct Client-to-Client protocols. Regular updates of the Linux kernel are essential to maintain these boundary checks against evolving attack vectors targeting memory safety flaws in networking subsystems.